Low risk browser extensions

LCHS Go loads executable Day.js modules from unpkg.com into its background service worker.

Lamborghini wallpapers loads Gameograf-controlled HTML into its new-tab and popup pages.

Latest Deals sends visited merchant hostnames to Google Analytics with a persistent extension client ID.

Lazada Chat Tuesday API Extension copies full page HTML from every HTTP and HTTPS site into extension messages.

LibreOffice Calc online sends each main-frame URL and its previous URL to www.runapps.org during browsing.

Lilo & Stitch Live Wallpaper sends new-tab shortcut domains to Google's favicon service.

Link Highlighter Pro loads Google Fonts and Font Awesome stylesheets when its extension pages open.

Lionel Messi Barcelona Wallpapers loads remote Gameograf content into its new-tab page without sanitizing it.

Looper for Youtube 2.0 writes its extension URL and incognito state into YouTube page sessionStorage.

Loopio Extension (New) lets HTTPS pages trigger storage changes that make it inject its scripts into the tab.

Lot Size Calculator sends TradingView pair analytics with a persistent browser or subscription identifier.

Lunabot sends each top-level page URL and title to Lunabot web-config APIs.

MZFy sends Amazon product-page views with the logged-in user ID to MZHub's product analyzer API.

Madara Uchiha (Naruto) Live Wallpaper requests Google favicons for user-added new-tab shortcuts.

Maps Hub Search reports Yahoo search-result activity to newtabtools.com with a persistent extension alias.

Marble sends your OS and IP-derived location to its Cloud Function when installed or updated.

Marvel Spider-Man Live Wallpaper loads remote Gameograf HTML into its new-tab page.

MemoryPlugin lets a localhost web page replace or clear the extension's saved authentication state.

Meno || Shell Shockers loads Discord-hosted images on ShellShock.io pages, sending page requests to cdn.discordapp.com.

Mercedes-Benz Wallpaper New Tab sends new-tab shortcut URLs to Google's favicon service.

Michael Jordan Wallpaper sends Chrome topSites URLs to Google's favicon service on the new-tab page.

Mimi Sound Personalization lets any website send messages that change its extension-wide audio settings.

Minecraft Cursor loads Google Fonts in its popup and opens Yowgames pages during install and uninstall.

Mitsuri Kanroji - Demon Slayer 4K Wallpaper renders remote Gameograf notification HTML in its new-tab page.

MoEngage Assist lets webpages send custom telemetry events to MoEngage through its extension bridge.

MockMan stores saved mock API rules in every visited page's localStorage and reports saved mock URLs to Segment.

Monetory.Toolkit sends P2P exchange page and trade activity to Google Analytics with a persistent client ID.

MonkeyTab sends displayed Chrome topSites URLs to Google's favicon service on its new-tab page.

MultiGPT modifies request headers for ChatGPT, Bing, Perplexity, and Phind service requests.

My Hero Academia Chibi Wallpaper sends top-site URLs to Google's favicon service on each new tab.

My Melody Wallpaper fetches remote HTML from api.gameograf.com and inserts it into its new-tab page.

My Reseller Genie Web Extension lets localhost pages request marketplace cookies and extension-made fetches.

MySnapFace lets page scripts trigger its image button and send image URLs to app.mysnapface.com with your session.

Myfone Chrome udvidelse lets page scripts trigger click-to-call requests to myfone.dk from rewritten phone numbers.

Neon Cursor lets any web page add custom cursor entries to the extension's local storage.

Neon Genesis Evangelion Wallpaper sends top-site URLs to Google for favicons on its new-tab page.

NetSuite Scripted Records injects a page UI that loads a Buy Me a Coffee image from cdn.buymeacoffee.com.

New Tab Redirect contacts picsum.photos for background images when its new-tab page loads.

Newmoney.AI lets embedded frames request connected wallet addresses using the top-level site's approval.

NexusMods Advance loads Font Awesome from cdnjs on Nexus Mods pages, sending page-request metadata to Cloudflare.

Neymar New Tab Wallpaper sends custom shortcut URLs to Google's favicon service.

Nighthawk by PhishFort sends an embedded API key when it fetches its protection lists and rules.

NoPause Playback rewrites visibility, focus, and video pause behavior on every website.

NoTab removes security headers from every subframe loaded in the browser.

Nomad Global sends dollar-related Google search terms to Google Analytics with a persistent client identifier.

NotebookLM Jetpack lets any HTTPS site ask the extension to reload itself through an external message.

Numbr runs recurring CPU-intensive code in its popup when the extension is opened.

Omegle Alternatives removes frame and cross-origin security headers for pages opened by configured chat and payment sites.

One Click Add Parcel - WePost sends supported shopping-page URLs and parcel tracking numbers to www.wepost.com.my.

One-Click Image Saver lets webpages trigger image downloads through synthetic shortcut clicks.

One-click file attachment by file.kiwi lets localhost pages insert text into a user-selected editable field.

Open TortoiseSVN for Google Chrome sends matching link URLs from broad page clicks to its native TortoiseSVN host.

Outlook Web Plus loads a default wallpaper image from wallpapercave.com on Outlook pages.

Override Chrome's New Tab Policy sends the configured new-tab URL to Google Forms when the user clicks Help me.

P2P File Transfer includes a default WebSocket signaling key for p2p-2zan.onrender.com in its source.

Papa's Freezeria Unblocked Game - Launcher loads Google Fonts from its popup over plaintext HTTP.

Paperclips Copilot accepts page messages that can create highlights with selected text and the page URL.

Paraphrasing sends selected page text to OpenAI for rewriting with the user's stored API key.

Picture in Picture works with Paramount [QVI] uploads Paramount account and viewing details to me3x.online by default.

Pinterest Image Downloader accepts subscription callback URLs from any site and stores supplied identity data locally.